Windows CE Abstract Syntax Notation One Library Integer Overflow Vulnerability

Bugtraq ID:	24445
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 25 2003 12:00AM
Updated:	Jun 12 2007 11:09PM
Credit:	The vendor reported this issue.
Vulnerable:	Microsoft Windows CE 4.2
Not Vulnerable:

Windows CE Abstract Syntax Notation One Library Integer Overflow Vulnerability

Windows CE ASN.1 is prone to an integer-overflow vulnerability because it fails to prevent an arithmetic operation from wrapping around an integer value. This condition will cause the affected library to later allocate an insuficiently sized memory buffer, resulting in a buffer overflow.

A remote attacker can exploit this issue to execute arbitrary code in the context of applications using the affected library. Failed exploit attempts will likely result in denial-of-service conditions.

Microsoft Windows CE 4.2 is vulnerable to this issue.

Windows CE Abstract Syntax Notation One Library Integer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Windows CE Abstract Syntax Notation One Library Integer Overflow Vulnerability

Solution:
The vendor released an advisory and fixes to address this issue. Please see the references for more information.

Windows CE Abstract Syntax Notation One Library Integer Overflow Vulnerability

References:

• FIX: An exception occurs in Abstract Syntax Notation and the application quits u (Microsoft)
  
• Microsoft Windows CE Homepage (Microsoft)
  
• The Elephant Under the Carpet (and when I say 'carpet' I mean PDA) (Symantec )